CVE-2021-3456

An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denia...

Authorization

An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denia...

CVE-2021-3456

An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denia...

PT-2022-10352

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description An issue with improper authorization handling was discovered, allowing authenticated local attackers to access and delete limited resources, and causing a denial of service on the server. The...

CVE-2021-3456: Incorrect Authorization

An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denia...

FreeBSD : gitea -- Improper/incorrect authorization (0ff80f41-aefe-11ec-b4b6-d05099c0c059)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0ff80f41-aefe-11ec-b4b6-d05099c0c059 advisory. - Improper Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. CVE-2022-0905 Note that...

PT-2022-13386

Name of the Vulnerable Software and Affected Versions Amelia WordPress plugin version 1.0.46 and earlier Description The issue allows any customer to update other's bookings and retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it,...

CVE-2022-0720: Incorrect Authorization

The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it...

GitLab 8.8.x - 9.5.10, 10.x - 10.1.5, 10.2.x - 10.2.5, 10.3.x - 10.3.3 Improper Authorization Vulnerability

GitLab is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab"; if...

CVE-2021-20290

An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a...

CVE-2021-20290: Incorrect Authorization

An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a...

PT-2022-9177

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description An improper authorization handling flaw was found, allowing an authenticated local attacker to access and delete limited resources, and also causing a denial of service on the server. The...

Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure

The plugin does not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it. PoC Although the API only...

The vulnerability of the Magento Commerce software platform for developing and managing online stores, related to improper authorization, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Magento Commerce development and management software platform is related to improper authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Gogs < 0.12.5 Multiple Vulnerabilities

Gogs is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

GHSA-RJMQ-6V55-4RJV Improper Authorization in org.cometd.oort

Impact Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's possibly sensitive data. By publishi...

Improper Authorization in org.cometd.oort

Impact Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's possibly sensitive data. By publishi...

CVE-2022-24721

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may b...

CVE-2022-24721: Incorrect Authorization

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may b...

PT-2022-16829

Name of the Vulnerable Software and Affected Versions CometD versions prior to 5.0.11, 6.0.6, and 7.0.6 Description CometD is a scalable comet implementation for web messaging. In versions prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, allowi...